Silver
Fits your needsYour first controlled window
$1,700USD
- Levels
- 1–2
- Geolocations
- 2
- Hours / year
- 1
- Domains
- 1
1 step per test plan · 30-day retention · unlimited seats
Request a scoped demoAuthorized DDoS resilience testing
Prove your defenses before the real incident does.
Ddosphere is an enterprise cloud platform for authorized DDoS resilience testing. Put controlled, distributed load on infrastructure you own, validate your mitigation, and leave with a report your teams can act on.
Authorized targets only · Emergency stop on every run
- Regions
- Global
- Scheduling
- 24/7
- Team seats
- Unlimited
The problem
Most teams only discover their DDoS posture during an outage.
Playbooks look complete on paper. Mitigation is contracted. Dashboards are green. None of that answers the only question the board will ask after an incident:
Did the controls hold, how fast did we recover, and what failed first?
Unproven mitigation
You pay for protection you have never exercised under realistic, multi-region load.
No shared evidence
SecOps, infra, and leadership argue from different dashboards. There is no single test record.
Slow learning
After an incident the knowledge lives in a ticket thread. It does not become the next test plan.
Platform
Everything you need to run a test and share the result.
Start in minutes
Pick a target, a test type, and a level. Press Run.
Multi-step plans
Chain steps in one test, each with its own type, load, and duration.
Scheduled runs
Repeat a test every hour, day, week, or month.
Roles for every seat
Admins and Attackers run tests. Observers only watch.
Reports as PDF
Export any run as a PDF your team can pass around.
Filter by target
See every run against one system, and nothing else.
Global coverage
Cloud regions on six continents, or your own hardware.
Load arrives the way real traffic does: from cloud regions worldwide, from dedicated generators on your own machines, or both in one run. Each region you pick counts as one geolocation in your package.
Swipe to see every regionCloud region
- California
- Canada
- São Paulo
- Frankfurt
- Ireland
- Stockholm
- Spain
- Zurich
- Milan
- Bahrain
- UAE
- Cape Town
- Istanbul
- Mumbai
- Singapore
- Tokyo
- Hong Kong
- Sydney
Available regions are managed by us. Dedicated generators run as containers on your own machines, are set up with us, and join the same run as the cloud regions.
Outcomes
A test is only useful if the organization can learn from it.
Institutional memory
Past runs stay in the product, not in someone's inbox.
Live control
Watch the test unfold. Stop it when the signal is enough.
Comparison, not folklore
Two scenarios side by side. Numbers, not stories.
DRR Score
A 0 to 100 DDoS Resilience Rating: a briefing score for the room, not a vanity metric.
Built for your industry
For security and infrastructure teams that cannot afford to guess.
Banking. Online and mobile banking are the first thing customers notice in an outage. Prove your mitigation holds before a campaign tests it for you.
Request a scoped demoHow it works
Six steps. One authorized window.
- 1
Authorize
Ownership and written scope are confirmed with our team before anything starts.
- 2
Select the target
Only assets inside that scope, registered to your organization by our team.
- 3
Configure
Vector family, level, regions, and duration, ordered into steps.
- 4
Run
A distributed simulation from the regions you selected, in the window you booked.
- 5
Monitor
A live view of load and response time, with the emergency stop on the same screen.
- 6
Review
The report and DRR Score. Decide what changes before the next window.
Test vectors
Every test type your protection will meet.
82 test types, grouped into 8 families across layers 3, 4, and 7. Every type is listed in the product when you build a test plan.
- 7L7measured in TPS
HTTP(S)
Application requests against your web tier, CDN, and origin.
- 62L4measured in PPS
TCP
Connection and flag handling on your edge and stateful devices.
- 2L4measured in PPS
TLS / SSL
Handshake and negotiation cost on terminating devices.
- 2L4measured in BPS
DNS
Resolver and DNS path behaviour under query volume.
- 2L7 / L4measured in PPS · TPS
Slow connections
Long-lived, low-rate connections that tie up worker slots.
- 4L4measured in BPS
UDP
Bandwidth and stateless filtering under volumetric load.
- 2L3measured in BPS
ICMP
Network-layer rate limiting and edge filtering.
- 1L4measured in PPS
MQTT
Broker behaviour for connected-device platforms.
Levels
Five intensity bands. Shared language for legal and infra.
Every scenario runs at one of five levels, and each level caps the load a test can place on the network. Exact BPS, PPS, and TPS values are shown in the product and shared during onboarding.
- L1
- L2
- L3
- L4
- L5
SilverL1–L2
GoldL1–L3
PlatinumL1–L4
L5
Level 5 is scoped on request.
Governance
Built so security and legal can sign off.
Ddosphere is not a way to attack anyone. Every test is scoped, permissioned, and reversible.
- Authorized use only
- Our team registers a target only after ownership and a signed scope are confirmed. There is no self-service target.
- Data protection
- Encrypted in transit. Run data is kept for 30, 180, or 365 days, depending on your package.
- Reversible
- The emergency stop is a first-class control. Stop the whole run or a single step, at any second.
Pricing
Packages sized to the window you need.
Tell us what you need to test, and the smallest package that covers it lights up.
Build your packageAnswer four questions. The package that fits lights up below.
Silver is the smallest package that fits.
Your package: Silver$1,700
See itHighlighted below, with everything it includes
Gold
Also fitsMost chosen
$2,700USD
- Levels
- 1–3
- Geolocations
- 3
- Hours / year
- 3
- Domains
- 3
Up to 3 steps per test plan · 180-day retention · unlimited seats
Request a scoped demoPlatinum
Also fitsA broader program
$6,500USD
- Levels
- 1–4
- Geolocations
- 5
- Hours / year
- 5
- Domains
- Any
Up to 5 steps per test plan · 365-day retention · parallel execution (2 runs at once) · unlimited seats
Request a scoped demoCompare every limit8 limits across 3 packages, with what each one meansShow table
Load
Test levels
The highest of the five load levels a scenario can use.
- Silver
- 1 to 2
- Gold
- 1 to 3
- Platinum
- 1 to 4
Steps per test plan
How many steps you can chain inside one test plan.
- Silver
- 1
- Gold
- Up to 3
- Platinum
- Up to 5
Reach
Geolocations per run
How many regions a single run can use at once.
- Silver
- Up to 2
- Gold
- Up to 3
- Platinum
- Up to 5
Domains
How many domains can be registered as targets.
- Silver
- 1
- Gold
- Up to 3
- Platinum
- Unlimited
Time
Test time per year
Total test hours for the year. One run cannot exceed it.
- Silver
- 1 hour
- Gold
- 3 hours
- Platinum
- 5 hours
Runs at the same time
How many runs can be active in parallel.
- Silver
- 1
- Gold
- 1
- Platinum
- 2
Data and team
Data retention
How long run readings stay available in the product.
- Silver
- 30 days
- Gold
- 180 days
- Platinum
- 365 days
Team seats
People you can invite, with any role.
- Silver
- Unlimited
- Gold
- Unlimited
- Platinum
- Unlimited
Need an extra region or a custom intensity? We scope it.
Every package: emergency stop, roles, and a written report.
FAQ
Frequently asked questions.
What is Ddosphere?
An enterprise platform for authorized DDoS resilience testing: controlled, distributed load against infrastructure you own, a live console while it runs, and a report you can export as PDF when it ends.
Who may run a test?
Only your organization, and only against targets our team has registered to it. Inside your team, admins and members with the Attacker role can build, schedule, start, and stop tests. Observers can follow runs and read results, but cannot start or change anything.
How is a test performed?
You build a test plan of up to your package's step limit, pick the regions it runs from, and start it now or put it on a schedule. The load comes from cloud machines we launch in those regions for that run and shut down when it ends.
Can a test be shorter than one hour?
Yes. A step can run for as little as 30 seconds. Test time is reserved in whole hours when a run starts, so a 20-minute run uses one hour. If you stop early, any whole hours you did not use go back to your balance.
Which test types are supported?
82 types in eight families: HTTP(S), TCP, TLS/SSL, DNS, slow connections, UDP, ICMP, and MQTT, across layers 3, 4, and 7. You see the full list when you build a test plan.
Can we stop immediately?
Yes. From the console you can stop the whole run, stop only the current step, or move on to the next one. Stopping asks for a single confirmation, so it never happens by accident.
Can tests run on a schedule?
Yes. A test can repeat every set number of hours, days, weeks, or months. Before saving, the schedule is checked against your remaining test time and the length of the test, so it cannot overrun your package.
How is our data handled?
All traffic to the platform is encrypted in transit. The measurements recorded during each run are kept for your package's retention period: 30, 180, or 365 days.
Is this DDoS-for-hire?
No. Targets cannot be added from your side. Our team registers each one to your organization, and a test can only point at a registered target.
Where are you based?
Berlin and Istanbul. Test origins include Frankfurt, Singapore, São Paulo, Tokyo, and more.
Something else? Ask us directly.
Contact
Tell us what you need to prove.
Share the infrastructure and the scope you are authorized for. We size the package, register your targets, and you launch the first run.
- [email protected]
- Offices
- Berlin, Germany / Istanbul, Türkiye
- Already a customer?
- Sign in